My understanding is AY keeps your credit card details anyway if you ever bought a ticket from them. When I got my GDPR report from AY, it had my credit card numbers from years back (part of the number blacked out). I asked them to delete it but they replied they won't because they are required by law to keep some data blaahblaah. It is supposedly kept separate from other customer data.